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IN THE CLAIMS 



Amended claims follow: 

1. (Currently Amended) A computer program product for controlling a computer, 
said computer program product comprising: 

(i) scan request receiving logic operable to receive a request to perform an on- 
access malware scan upon a computer file to which access is to be made; 

(ii) scan dividing logic operable to divide said on-access malware scan into a 
plurality of tasks; 

(iii) task issuing logic operable to issue said plurality of tasks to be performed by 
a plurality of different computers; and 

(iv) result collating logic operable to collate a plurality of task results 
corresponding to said plurality of tasks and received from said plurality of different 
computers to form a scan result corresponding to said on-access malware scan. 

2. (Currently Amended). A computer program product as claimed in claim 1 ? 
wherein said scan dividing logic farther divides said computer file into a plurality of 
component computer files to be separately scanned as said plurality of tasks. 

3. (Currently Amended) A computer program product as claimed in claim 2, 
wherein said computer file contains one or more embedded computer files which are 
further d ivided out as component computer files. 

4. (Original) A computer program product as claimed in claim 3, wherein said 
computer file is one of the following computer file types: OLE2, ZIP, CAB, ARJ, RAR, 
ACE, JAR, ARC, LHA, LZH, ICE and Stufflt. 

5. (Currently Amended) A computer program product as claimed in claim 1, 
wherein said scan dividing logic further d ivides said on-access malware scan into a 
plurality of on-access malware scans for identifying different properties of said computer 
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file, said plurality of on-access malware scans being separately performed as said 
plurality of tasks. 

6. (Currently Amended) A computer program product as claimed in claim 5, 
wherein said plurality of tasks each seek to further i dentify different portions of one of a 
cryptographic analysis and an emulation analysis. 

7. (Original) A computer program product as claimed in claim 1 , wherein said on- 
access malware scan of said computer file seeks to identify one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 

(v) an e-mail containing banned content. 

8. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein one or more of said tasks are foe rfurther divided into sub-tasks. 

9. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein a task i s further selected to be issued to a different computer in dependence upon 
one or more of: 

(i) a measure of available processing resources at said different computer, 

(ii) a measure of communication channel bandwidth to said different computer; 

(iii) a measure of task complexity of said task to be issued; and 

(iv) a measure of processor utilization of said different computer. 

1 0. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said scan dividing logic does not further d ivide said on-access malware scan if 
said on-access malware scan is detected as having a complexity below a predetermined 
threshold level. 
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1 1 . (Currently Amended) A computer program product as claimed in claim 10, 
wherein said complexity i s further determined as a function of one or more of: 

(i) a file type of said computer file; 

(ii) whether said computer file contains any embedded computer files; 

(iii) a level of nesting of embedded files within said computer file; 

(iv) an initial scanning attempt of said computer file taking longer than a 
predetermined time; and 

(v) processor utilization of a computer initiating said request. 

1 2. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said result collating logi c ftuther terminates any outstanding tasks if a task result 
is received indicating detection of malware within said computer file. 

1 3 . (Currently Amended) A computer program product for controlling a computer, 
said computer program product comprising: 

(i) task receiving logic operable to receive a request to perform a malware 
scanning task that is part of an on-access malware scan of a computer file requested by 
another computer; 

(ii) scanning logic operable to perform said malware scanning task; and 

(iii) result returning logic operable to return a result of said malware scanning 

task; 

wherein said malware scanning task is one of a plurality of malware scanning 
tasks that are each part of said on-access malware scan; 

wherein a plurality of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan[[ ]]. 

14. (Currently Amended) A computer program product as claimed in claim 13, 
wherein said computer file i s further divided into a plurality of component computer files 
to be separately scanned as separate malware scanning tasks. 
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15. (Currently Amended) A computer program product as claimed in claim 13, 
wherein said on-access malware scan of said computer file is further divided into said 
plurality of on-access malware scanning tasks for identifying different properties of said 
computer file, said plurality of on-access malware scanning tasks being separately 
performed. 

16. (Currently Amended) A method of performing an on-access malware scan of a 
computer file, said method comprising the steps of: 

(i) receiving a request to perform an on-access malware scan upon a computer file 
to which access is to be made; 

(ii) dividing said on-access malware scan into a plurality of tasks; 

(iii) issuing said plurality of tasks to be performed by a plurality of different 
computers; and 

(iv) collating a plurality of task results corresponding to said plurality of tasks and 
received from said plurality of different computers to form a scan result corresponding to 
said on-access malware scan. 

17. (Currently Amended) A method as claimed in claim 16, wherein said computer 
file is furtherd ivided into a plurality of component computer files to be separately 
scanned as said plurality of tasks. 

1 8 . (Currently Amended) A method as claimed in claim 1 7, wherein said computer 
file contains one or more embedded computer files which are farther d ivided out as 
component computer files, 

1 9. (Original) A method as claimed in claim 1 8, wherein said computer file is one of 
the following computer file types: OLE2, ZIP, CAB, AJRJ, RAR, ACE, JAR, ARC, LHA, 
LZH, ICE and Stufflt 

20. (Currently Amended) A method as claimed in claim 16, wherein said on-access 
malware scan is further divided into a plurality of on-access malware scans for 
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identifying different properties of said computer file, said plurality of on-access malware 
scans being separately performed as said plurality of tasks. 

21 . (Currently Amended) A method as claimed in claim 20, wherein said plurality of 
tasks each seek to further i dentify different portions of one of a cryptographic analysis 
and an emulation analysis. 

22. (Currently Amended) A method as claimed in claim 16, wherein said on-access 
malware scan of said computer fil e further seeks to identify one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and 

(v) an e-mail containing banned content 

23. (Original) A method as claimed in claim 16, wherein one or more of said tasks are 
further divided into sub-tasks. 

24. (Currently Amended) A method as claimed in claim 1 6, wherein a task is further 
selected to be issued to a different computer in dependence upon one or more of; 

(i) a measure of available processing resources at said different computer; 

(ii) a measure of communication channel bandwidth to said different computer; 

(iii) a measure of task complexity of said task to be issued; and 

(iv) a measure of processor utilization of said different computer. 

25. (Currently Amended) A method as claimed in claim 16, wherein said on-access 
malware scan is not further d ivided if said on-access malware scan is detected as having a 
complexity below a predetermined threshold level, 

26. (Currently Amended) A method as claimed in claim 25, wherein said complexity 
is farther determined as a function of one or more of: 
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(i) a file type of said computer file; 

(ii) whether said computer file contains any embedded computer files; 

(iii) a level of nesting of embedded files within said computer file; 

(iv) an initial scanning attempt of said computer file taking longer than a 
predetermined time; and 

(v) processor utilization of a computer initiating said request, 

27. (Cuirendy Amended) A method as claimed in claim 16, wherein any outstanding 
tasks ar e further terminated if a task result is received indicating detection of malware 
within said computer file. 

28. (Previously Presented) A method of on-access malware scanning, said method 
comprising the steps of: 

(i) receiving a request to perform a malware scanning task that is part of an on- 
access malware scan of a computer file requested by another computer; 

(ii) performing said malware scanning task; and 

(iii) returning a result of said malware scanning task; 

wherein said malware scanning task is one of a plurality of malware scanning 
tasks that are each part of said on-access malware scan; 

wherein a plurality of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan. 

29. (Currently Amended) A method as claimed in claim 28, wherein said computer 
file i sjurther divided into a plurality of component computer files to be separately 
scanned as separate malware scanning tasks. 

30. (Currently Amended) A method claimed in claim 28, wherein said on-access 
malware scan of said computer file is farther divided into said plurality of on-access 
malware scanning tasks for identifying different properties of said computer file, said 
plurality of on-access malware scanning tasks being separately performed. 
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3 1 . (Currently Amended) Apparatus for performing an on-access malware scan of a 
computer file, said apparatus comprising: 

(i) a scan request receiver operable to receive a request to perform an on-access 
malware scan upon a computer file to which access is to be made; 

(ii) a scan divider operable to divide said on-access malware scan into a plurality 
of tasks; 

(iii) a task issuer operable to issue said plurality of tasks to be performed by a 
plurality of different computers; and 

(iv) a result collator operable to collate a plurality of task results corresponding to 
said plurality of tasks and received from said plurality of different computers to form a 
scan result corresponding to said on-access malware scan. 

32. (Currently Amended) Apparatus as claimed in claim 3 1 , wherein said scan divider 
further d ivides said computer file into a plurality of component computer files to be 
separately scanned as said plurality of tasks. 

33 . (Currently Amended) Apparatus as claimed in claim 32, wherein said computer 
file contains one or more embedded computer files which are further d ivided out as 
component computer files. 

34. (Original) Apparatus as claimed in claim 33, wherein said computer file is one of 
the following computer file types: OLE2, ZIP, CAB, ARJ, RAR, ACE, JAR, ARC, LHA, 
LZH, ICE and Stufflt 

35. (Currently Amended) Apparatus as claimed in claim 3 1, wherein said scan divider 
further d ivides said on-access malware scan into a plurality of on-access malware scans 
for identifying different properties of said computer file, said plurality of on-access 
malware scans being separately performed as said plurality of tasks. 

36. (Currently Amended) Apparatus as claimed in claim 35, wherein said plurality of 
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tasks each seek to ftohgridentify different portions of one of a cryptographic analysis 
and an emulation analysis. 

37, (Currently Amended) Apparatus as claimed in claim 3 1 , wherein said on-access 
malware scan of said computer fil e further seeks to identify one or more of: 

(i) a computer virus; 

(ii) a Trojan computer program; 

(iii) a worm computer program; 

(iv) a banned computer program; and an e-mail containing banned content. 

3 8 , (Original) Apparatus as claimed in claim 3 1 , wherein one or more of said tasks 
are further divided into sub-tasks. 

39. (Currently Amended) Apparatus as claimed in claim 3 1 , wherein a task is further 
selected to be issued to a different computer in dependence upon one or more of: 

(i) a measure of available processing resources at said different computer; 

(ii) a measure of communication channel bandwidth to said different computer; 

(iii) a measure of task complexity of said task to be issued; and 

(iv) a measure of processor utilization of said different computer. 

40. (Currently Amended) Apparatus as claimed in claim 3 1 , wherein said scan divider 
does not furthe^divide said on-access malware scan if said on-access malware scan is 
detected as having a complexity below a predetermined threshold level. 

41 . (Currently Amended) Apparatus as claimed in claim 40, wherein said complexity 
is furfl^determined as a function of one or more of: 

(i) a file type of said computer file; 

(ii) whether said computer file contains any embedded computer files; 

(iii) a level of nesting of embedded files within said computer file; 

(v) an initial scanning attempt of said computer file taking longer than a 
predetermined time; and 
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(vi) processor utilization of a computer initiating said request 

42. (Currently Amended) Apparatus as claimed in claim 3 1 , wherein said result 
collator further t erminates any outstanding tasks if a task result is received indicating 
detection of malware within said computer file. 

43. (Previously Presented) Apparatus for performing an on-access malware scan of a 
computer file, said apparatus comprising: 

(i) a task receiver operable to receive a request to perform a malware scanning 
task that is part of an on-access malware scan of a computer file requested by another 
computer; 

(ii> a scanner operable to perform said malware scanning task; and 

(iii) a result returner operable to return a result of said malware scanning task; 

wherein said malware scanning task is one of a plurality of malware scanning 
tasks that are each part of said on-access malware scan; 

wherein a plurality of malware scanning task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan. 

44. (Currently Amended) Apparatus as claimed in claim 43, wherein said computer 
file is further d ivided into a plurality of component computer files to be separately 
scanned as separate malware scanning tasks. 

45. (Currently Amended) Apparatus as claimed in claim 43, wherein said on-access 
malware scan of said computer file is further divided into said plurality of on-access 
malware scanning tasks for identifying different properties of said computer file, said 
plurality of on-access malware scanning tasks being separately performed. 

46. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said scan dividing logic further divides said on-access malware scan in response 
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to a complexity metric exceeding a predetermined threshold, where the complexity metric 
is dependent on at least one parameter. 

47. (Currently Amended) A computer program product as claimed in claim 46, 
wherein the paramete r further includes at least one of a computer file type, a level of 
nesting of embedded computer files, an initial attempt to scan said computer file which 
exceeded a predetermined time, and a level of utilization of a local processor. 

48. (Currently Amended) A computer program product as claim e d in claim 46. for 
controlling a computer, said computer program product comprising: 

ffl scan request receiving logic operable to receive a reouest to perform an on- 
access malware scan upon a computer file to which access is to be made; 

fifl scan dividing logic operable to divide said on-access malware scan into a 
plurality of tasks; 

( iii) task issuing logic operable to issue said plurality of tasks to be performed bv 
a plurality of different computers: and 

(iv) result collating logic operable to collate a plurality of task results 
corresponding to said plurality of tasks and received from said plurality of different 
computers to form a scan result corresponding to said on-access malware scan; 

wherein said scan dividing logic divides said on-access malware scan in response 
to a complexity metric exceeding a predetermined threshold where the complexity metric 
is dependent on at least one parameter: 

wherein the complexity metric is dependent on a plurality of parameters including 
a computer file type, a level of nesting of embedded computer files, an initial attempt to , 
scan said computer file which exceeded a predetermined time, and a level of utilization of 
a local processor. 

49. (Currently Amended) A computer program product as claim e d in claim 46v for 
controlling a computer^ said computer program product comprising: 

(0 scan request receiving logic operable to receive a request to perform an on- 
access malware scan upon a computer file to which access is to be made: 
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(ii) scan dividing logic operable to divide said on-access malware scan into a 
plurality of tasks; 

(in) task issuing fo^ic operable to issfue sakj plurality of tasks to be performed by 
plurality of differ compute^; and 

fiv) result collating logic operable to collate a plurality of task tesults 
corresponding to said plurality of tasks and received from said plurality of different 
computers to form a scan result corresponding to said on-access malware scan; 

wherein said scan dividing logic divides said on-access malware scan in response 
to a complexity metric exceeding a predetermined threshold, where the complexity metric 
is dependent on at least one parameter; 

wherein an amount said complexity metric exceeds said predetermined threshold 
determines a number of tasks into which said on-access malware scan is divided, 

50. (Currently Amended) A computer program product as claimed in claim 1 , 
wherein if one of said plurality of task result s further indicates that malware has been 
detected in said computer file, remaining tasks in said plurality of tasks that are pending 
are terminated. 

5 1 . (Currently Amended) A computer program product as claimed in claim 1 , 
wherein said plurality of tasks are further distributed among said plurality of different 
computers via a network, 
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